ci: publish release image tags

.github/workflows/ci.yml

@@ -3,8 +3,24 @@ name: CI
 on:
   push:
     branches: [main, develop]
+    tags: ['v*']
   pull_request:
     branches: [main, develop]
+  workflow_dispatch:
+    inputs:
+      release_ref:
+        description: Git ref to build, for example v1.8.4
+        required: false
+        type: string
+      release_tag:
+        description: Release image tag to publish, for example v1.8.4
+        required: false
+        type: string
+      promote_stable:
+        description: Also publish the stable image tag
+        required: false
+        default: false
+        type: boolean
   schedule:
     # Weekly security scan on Mondays at 00:00 UTC
     - cron: '0 0 * * 1'
@@ -197,7 +213,10 @@ jobs:
     name: Docker Build & Publish
     runs-on: ubuntu-latest
     needs: [test, security]
-    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+    if: >-
+      (github.event_name == 'push' && github.ref == 'refs/heads/main') ||
+      (github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')) ||
+      github.event_name == 'workflow_dispatch'
     permissions:
       contents: read
       packages: write
@@ -205,6 +224,8 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.inputs.release_ref || github.ref }}
 
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
@@ -223,7 +244,11 @@ jobs:
           images: ghcr.io/${{ github.repository }}
           tags: |
             type=ref,event=branch
+            type=ref,event=tag
+            type=semver,pattern={{version}}
             type=sha,prefix=
+            type=raw,value=${{ github.event.inputs.release_tag }},enable=${{ github.event_name == 'workflow_dispatch' && github.event.inputs.release_tag != '' }}
+            type=raw,value=stable,enable=${{ startsWith(github.ref, 'refs/tags/v') || github.event.inputs.promote_stable == 'true' }}
             type=raw,value=latest,enable={{is_default_branch}}
 
       - name: Build and push Docker image